https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
r
Their root CA expired at the end on may, I think
r
The root I have expires in 2038?
good article, this should help me find my way
e
Linux and MAC won't automatically download missing CA like Windows. Therefore you need to upload and link all certs on ADC
root and intermediate
r
root too? šŸ˜•
e
yes all certs you see in the chain on Windows. And you cannot upload them vServer, you need to link them under Certificates
c
Just link to the Sectigo intermediate and no further. Should only be one link in the chain.
s
Supported Ciphers with Clients also required to be adjusted
For Win7 Client I faced the issue with few customers
r
I think i just have the wrong intermediate. They have 4. I found the EVBundle worked on my Wyse
šŸ‘ 1
i hate linking the root. Will try this other intermediate and see if that fixes it.....
anyone know if screwing with the cert links will kill all sessions? I'd think it would?
e
no it will not
r
it won't? That shocks me
e
but I am not 100% sure, but did not for me when I did for a customer. Makes no sense case the sessions are already running
d
Sectigo here on ADC, linked only to Intermediate, working on Win/MacOS no problem.
r
Wildcard cert? Which Intermediate?
d
Yes wildcard. Hold on.
r
our is the 33e4e8080 thumprint
I hope you say a3df966d
r
@Ryan Gallier I have seen this at a customer as well. We found out that there was an old root certificate on the ADC which had expired in May. Windows 10 clients still worked but MAC and W7 gave issues. Just remove the old CA
r
windows is fine. just MAC and Wyse are having issues
d
ours is 33e4e8 as well i'm afraid šŸ˜ž
r
wow, that's 100% not working for us.
let me triple check the NS
Yeah, Serial # 7d5b5126b476ba11db74160bbc530da7
d
i don't have the root on there anywhere by the looks of it. just that inter under CA Certificates.
Yes that very same serial number.
i'm on 12.1 55.18
r
me too... that's very odd..... MAC was 100% not working. wildcard for sure? I was thinking we needed the EV intermediate, not the domain validatation Secure Server Intermediate
d
yeah wildcard. we have a few from them on ADC, all chain up the same way via that intermediate. No EV.
l
Don't mess around trying to find the missing one, use a windows box. Fire up mmc, import your certificate, look at the chain and export what you want from there. I have found that apple devices prefer the full chain to be published. Its not any less secure to do so btw... its a public certificate.
šŸ’Æ 1
d
What does the Mac's keychain look like? Does it trust the inter at least?
yes i almost always have to do what Leee said šŸ™‚
r
that's a way better idea... that thumbprint is different than what's imported...
wtf, seriously
I hate certs
d
and sometimes just get the ca-bundles, import them all to mmc, then check the chain and export.
l
I always use mmc and take what I need from there for any other devices, it is actually something microsoft handles really well in my opinion.
r
was looking at the wrong cert... no, the intermediate is the same cert linked
33e4e80807204c2b6182a3a14b591acd25b5f0db
d
yeah when Sectigo's root expired the other day, most Windows boxes adjusted themselves, but not all of course, nor MacOS, so it threw us for a bit.
l
I also personally like to split the certs out rather than relaying on "include all intermediary/roots" because windows doesn't always get that right.
Wait until you need to fiddle with a java keystore šŸ˜‚
r
i keep hearing both sides... link the root... don't link the root... what's "right" ?
d
lol i've already got those scars šŸ˜ž Java has a special place in hell.
r
i've done that as well, with this program called "Blackboard".. nightmare
l
There is no right option really, its not a security risk but it does allow older devices to connect.
d
for me, i followed @Carl Stalhoodā€™s guide, linked just the inter, didn't even install the root on the NS, and all is working. The Mac needs to trust the inter/root so worth confirming they in the keychain.
r
it was not in there, they had to install it manually
l
but... thats what I've found with apple. For an internal CA thats different. I dont want my root cert on the external facing side at all. A public cert though, all good.
r
i wonder if it was an old version of MacOS
d
Possibly yes. I guess Apple update them intermittently with their monolithic OS updates.
r
oh ffs... yes, it was on 10.11..... not macOS Sierra 10.12.1 Public Beta 2
šŸ¤¦
you guys are the best, thanks!!!
l
No worries dude.
d
šŸ’„
šŸ‘ 1
4 Views
Open in Slack
PreviousNext
Powered by